Cloudanix VulnDB

CVE-2026-98442

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory-handling error in the Linux kernel's network connection tracking could let attackers crash systems or interfere with traffic processing until the kernel is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel net/sched act_ct when nf_ct_helper() wires a raw pointer into the expectations list before *_ext_add() reallocates the extension space, leaving an invalid reference accessed on later nf_ct_expect removal.

Why it matters to the business

Kernel memory corruption risk on Linux systems handling conntrack helpers can cause crashes, service disruption, or limited privilege escalation in network processing paths; low exploit probability and five-day-old disclosure keep immediate operational exposure modest for most deployments.

How an attack unfolds

An attacker sends traffic that activates a conntrack helper before all extensions are allocated, causing the helper to insert an expectation holding a stale pointer; subsequent extension growth frees the original memory and later expectation cleanup dereferences it.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix that invokes helpers only after every extension has been added; rebuild and reboot affected systems with the corrected netfilter code.

How to confirm the fix worked

Verify the running kernel contains the commit that reorders helper invocation after *_ext_add calls; inspect /proc/version or kernel source for the act_ct change and confirm absence of the original pointer-wiring pattern.

Typical attack path

  1. Send crafted packets that engage nf_conntrack helpers
  2. Trigger additional extension allocations via act_ct before confirmation
  3. Force expectation removal to access the now-freed extension pointer

How to detect it

Search kernel logs and netfilter traces for oops or warnings referencing nf_ct_expect_insert, nf_ct_helper, or act_ct extension reallocation around the time of connection setup; monitor for repeated crashes during helper activation.

  • nf_ct_expect_insert
  • nf_ct_helper
  • act_ct
  • master_help->expectations
  • hlist_add_head_rcu

What your security team should do

  • Prioritize kernel updates on any system exposing conntrack-enabled interfaces
  • Review network policies to limit unnecessary helper usage until patched
  • Include kernel oops logs from netfilter paths in routine crash analysis

The record

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation. Make sure that helpers are called at the end after all the other extensions are already added. Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway.

Affected packages

Ecosystem Package Introduced Fixed